#include "os_common.h"
#include "wpa/eap.h"
VOID
Mds_reset_descriptor( IN PADAPTER Adapter )
{
	PMDS		pMds = &Adapter->Mds;

	pMds->TxPause = 0;
	pMds->TxThreadCount = 0;
	pMds->TxFillIndex = 0;
	pMds->TxDesIndex = 0;
	pMds->ScanTxPause = 0;
	OS_MEMORY_CLEAR( pMds->TxOwner, ((MAX_USB_TX_BUFFER_NUMBER + 3) & ~0x03) );
}

BOOL
Mds_initial( IN PADAPTER Adapter )
{
	PMDS		pMds = &Adapter->Mds;

	pMds->TxPause = FALSE;
	pMds->TxRTSThreshold = DEFAULT_RTSThreshold;
	pMds->TxFragmentThreshold = DEFAULT_FRAGMENT_THRESHOLD;

	vRxTimerInit(Adapter);//for WPA countermeasure

	return hal_get_tx_buffer( &Adapter->sHwData, &pMds->pTxBuffer );
}

VOID
Mds_Destroy( IN PADAPTER Adapter )
{
	vRxTimerStop(Adapter);
}

VOID
Mds_Tx( IN PADAPTER Adapter )
{
	phw_data_t	pHwData = &Adapter->sHwData;
	PMDS		pMds = &Adapter->Mds;
	DESCRIPTOR	TxDes;
	PDESCRIPTOR	pTxDes = &TxDes;
	PUCHAR		XmitBufAddress;
	USHORT		XmitBufSize, PacketSize, stmp, CurrentSize, FragmentThreshold;
	UCHAR		FillIndex, TxDesIndex, PacketFrom, FragmentCount, FillCount;
	BOOLEAN		BufferFilled = FALSE, MICAdd;


	//931130.5.a
	if( pMds->TxPause )
		return;
	// 20060717.3 Add
	if( !hal_driver_init_OK( pHwData ) )
		return;

	//Only one thread can be run here
	if( OS_ATOMIC_INC( Adapter, &pMds->TxThreadCount ) == 1 )
	{
		// Start to fill the data
		do
		{
			FillIndex = pMds->TxFillIndex;
			if( pMds->TxOwner[FillIndex] ) // Is owned by software 0:Yes 1:No
			{
				#ifdef _PE_TX_DUMP_
				WBDEBUG(("[Mds_Tx] Tx Owner is H/W.\n"));
				#endif
				break;
			}

			XmitBufAddress = pMds->pTxBuffer + (MAX_USB_TX_BUFFER * FillIndex); //Get buffer
			XmitBufSize = 0;
			FillCount = 0;
			do
			{
				// Sending packet path
				PacketFrom = 1;
				PacketSize = QUERY_SIZE_FIRST( Adapter );
				if( !PacketSize )
				{
					if( !TS_RUNNING_IN_TESTSTA_MODE ) // If driver doesn't run in test mode, send MLME and normal data frame
					{
						PacketFrom = 2;
						PacketSize = QUERY_SIZE_SECOND( Adapter );
						if( !PacketSize )
						{
							if( pMds->ScanTxPause )	//No management frames to transmit.
								break;				//The scanning is progressing, so stop the data
												//frames transmission
							PacketFrom = 3;
							PacketSize = QUERY_SIZE_THIRD( Adapter );
							if( !PacketSize )
								break;
						}
					}
					else
						break;
				}

				//For Check the buffer resource
				FragmentThreshold = CURRENT_FRAGMENT_THRESHOLD;
				//931130.5.b
				FragmentCount = PacketSize/FragmentThreshold + 1;
				stmp = PacketSize + FragmentCount*32 + 8;//931130.5.c 8:MIC
				if( (XmitBufSize + stmp) >= MAX_USB_TX_BUFFER )
				{
					#ifdef _PE_TX_DUMP_
					WBDEBUG(("[Mds_Tx] Excess max tx buffer.\n"));
					#endif
					break; // buffer is not enough
				}


				//
				// Start transmitting
				//
				BufferFilled = TRUE;

				DESCRIPTOR_RESET( pTxDes );
				TxDesIndex = pMds->TxDesIndex;//Get the current ID
				DESCRIPTOR_SET_ID( pTxDes, TxDesIndex );
				pMds->TxDesFrom[ TxDesIndex ] = PacketFrom;//Storing the information of source comming from
				pMds->TxDesIndex++;
				pMds->TxDesIndex %= MAX_USB_TX_DESCRIPTOR;

				// Get packet to transmit, 1:TESTSTA 2:MLME 3: Ndis data
				if( PacketFrom == 3 )
					{ GET_DESCRIPTOR_THIRD( Adapter, pTxDes ); }
				else if( PacketFrom == 2 )
					{ GET_DESCRIPTOR_SECOND( Adapter, pTxDes ); }
				else if( PacketFrom == 1 )
					{ GET_DESCRIPTOR_FIRST( Adapter, pTxDes ); }

				// Copy header. 8byte USB + 24byte 802.11Hdr. Set TxRate, Preamble type
				Mds_HeaderCopy( Adapter, pTxDes, XmitBufAddress );

				// For speed up Key setting
				if( pTxDes->EapFix )
				{
					#ifdef _PE_TX_DUMP_
					WBDEBUG(("35: EPA 4th frame detected. Size = %d\n", PacketSize));
					#endif
					pHwData->IsKeyPreSet = 1;
				}

				//
				// Add MIC redundant 8 byte in pTxDes, assume that TKIP encryption and wep bit = 1
				MICAdd = (CURRENT_ENCRYPT_STATUS==ENCRYPT_TKIP) && (XmitBufAddress[9]&0x40);
				if( MICAdd )
				{
					pMds->MicAdd = 8;
					pMds->MicWriteIndex = 0;
					DESCRIPTOR_ADD_BUFFER( pTxDes, pMds->MicRedundant, 8 );
				}

				// Copy (fragment) frame body, and set USB, 802.11 hdr flag
				CurrentSize = Mds_BodyCopy( Adapter, pTxDes, XmitBufAddress );

				// Set RTS/CTS and Normal duration field into buffer
				Mds_DurationSet( Adapter, pTxDes, XmitBufAddress );

				//
				// Calculation MIC from buffer which maybe fragment, then fill into temporary address 8 byte
				// 931130.5.e
				if( MICAdd )
					Mds_MicFill( Adapter, pTxDes, XmitBufAddress );

				//Shift to the next address
				XmitBufSize += CurrentSize;
				XmitBufAddress += CurrentSize;

				#ifdef _IBSS_BEACON_SEQ_STICK_
				if( (XmitBufAddress[ DOT_11_DA_OFFSET+8 ] & 0xfc) != MAC_SUBTYPE_MNGMNT_PROBE_REQUEST ) // +8 for USB hdr
				#endif
				pMds->TxToggle = TRUE;

				//---------------------
				//Check Power save
				if (psSME->bDesiredPowerSave)
				{
					if ((psLOCAL->wConnectedSTAindex == 0) ||
							((psLOCAL->wConnectedSTAindex != 0) &&
								 (psBSS(psLOCAL->wConnectedSTAindex)->bBssType == ESS_NET)))
					{
						psLOCAL->boHasTxActivity = 1;
						if (psLOCAL->iPowerSaveMode == PWR_SAVE)
						{
							K_MSG	sSmeMsg;
							UCHAR		PsMode;

							//wake up the H/W
							PsMode =  PWR_ACTIVE;
							sSmeMsg.wMsgType = SMEMSG_POWERSAVE_REQ;
							sSmeMsg.pMsgPtr = &PsMode;
							SME_Entry(Adapter, &sSmeMsg);
						}
					}
				}

				#ifdef _PE_TX_DUMP_
				WBDEBUG((">>Send MSDU\n"));
				if (XmitBufSize > 0)
				{
					PUCHAR ptr;

					ptr = pMds->pTxBuffer + (MAX_USB_TX_BUFFER * FillIndex);
					WBDEBUG(("=== DUMP TX MSDU ===, size=%d\n", XmitBufSize));
					DataDmp( ptr, XmitBufSize, 0);
				}
				#endif

				// Get packet to transmit completed, 1:TESTSTA 2:MLME 3: Ndis data
				if( PacketFrom == 3 )
					{ GET_DESCRIPTOR_THIRD_COMPLETED( Adapter, pTxDes ); }
				else if( PacketFrom == 2 )
					{ GET_DESCRIPTOR_SECOND_COMPLETED( Adapter, pTxDes ); }
				else if( PacketFrom == 1 )
					{ GET_DESCRIPTOR_FIRST_COMPLETED( Adapter, pTxDes ); }

				// Software TSC count 20060214
				pMds->TxTsc++;
				if( pMds->TxTsc == 0 )
					pMds->TxTsc_2++;

				FillCount++; // 20060928

			}while( HAL_USB_MODE_BURST(pHwData) );// End of multiple MSDU copy loop. FALSE = single TRUE = multiple sending

			// Move to the next one, if necessary
			if( BufferFilled )
			{
				// size setting
				pMds->TxBufferSize[ FillIndex ] = XmitBufSize;

				// 20060928 set Tx count
				pMds->TxCountInBuffer[FillIndex] = FillCount;

				// Set owner flag
				pMds->TxOwner[FillIndex] = 1;

				pMds->TxFillIndex++;
				pMds->TxFillIndex %= MAX_USB_TX_BUFFER_NUMBER;
				BufferFilled = FALSE;
			}
			else
				break;

			if( !PacketSize )// No more pk for transmitting
				break;

		}while(TRUE);

		//
		// Start to send by lower module
		//
		if( !pHwData->IsKeyPreSet )
			Wb35Tx_start( pHwData );
	}

	OS_ATOMIC_DEC( Adapter, &pMds->TxThreadCount );
}

VOID
Mds_SendComplete( IN PADAPTER Adapter, IN PT02_DESCRIPTOR pT02 )
{
	PMDS	pMds = &Adapter->Mds;
	phw_data_t	pHwData = &Adapter->sHwData;
	PUCHAR	pTxBuffer;
	UCHAR	PacketId = (UCHAR)pT02->T02_Tx_PktID;
	BOOLEAN	SendOK = TRUE;
	UCHAR	RetryCount, TxRate;
	K_MSG	sSmeMsg;
	USHORT		wIndex, wReasonCode;


	if( pT02->T02_IgnoreResult ) // Donot care the result
		return;
    #ifdef _PE_TX_DUMP_
	WBDEBUG(("###  Tx complete, PacketId =%x, pT02->T02_Tx_PktID =%x\n",
							PacketId, pT02->T02_Tx_PktID));
    #endif	
	if( pT02->T02_IsLastMpdu )
	{
		//TODO: DTO -- get the retry count and fragment count
		// Tx rate
		//TxRate = pMds->TxRate[ PacketId ][ pT02->T02_effective_transmission_rate ];
		TxRate = pMds->TxRate[ PacketId ][ 0 ];
		RetryCount = (UCHAR)pT02->T02_MPDU_Cnt;
		if( pT02->value & FLAG_ERROR_TX_MASK )
		{
			SendOK = FALSE;
			#ifdef _PE_DTO_DUMP_
			WBDEBUG(("Mds Tx Fail[%d] = %8x\n", PacketId, pT02->value ));
			#endif
			if (pT02->T02_transmit_abort || pT02->T02_out_of_MaxTxMSDULiftTime)
			{
				//retry error
				pHwData->dto_tx_retry_count += (RetryCount+1);
				//[for tx debug]
				if (RetryCount<7)
					pHwData->tx_retry_count[RetryCount] += RetryCount;
				else
					pHwData->tx_retry_count[7] += RetryCount;
				#ifdef _PE_STATE_DUMP_
				WBDEBUG(("dto_tx_retry_count =%d\n", pHwData->dto_tx_retry_count));
				#endif
				MTO_SetTxCount(Adapter, TxRate, RetryCount);
			}
			pHwData->dto_tx_frag_count += (RetryCount+1);

			//[for tx debug]
			if (pT02->T02_transmit_abort_due_to_TBTT)
				pHwData->tx_TBTT_start_count++;
			//if (pT02->T02_effective_transmission_rate)
			//	pHwData->tx_ETR_count++;
			if (pT02->T02_transmit_without_encryption_due_to_wep_on_false)
				pHwData->tx_WepOn_false_count++;
			if (pT02->T02_discard_due_to_null_wep_key)
				pHwData->tx_Null_key_count++;
		}
		else
		{
			if (pT02->T02_effective_transmission_rate)
				pHwData->tx_ETR_count++;
			MTO_SetTxCount(Adapter, TxRate, RetryCount);
		}

		// Return result
		if( pMds->TxDesFrom[ PacketId ] == 3 )
			{ COMPLETE_DESCRIPTOR_THIRD( Adapter, PacketId, SendOK ); }
		else if( pMds->TxDesFrom[ PacketId ] == 2 )
			{ COMPLETE_DESCRIPTOR_SECOND( Adapter, PacketId, SendOK ); }
		else if( pMds->TxDesFrom[ PacketId ] == 1 )
			{ COMPLETE_DESCRIPTOR_FIRST( Adapter, PacketId, SendOK ); }

		//DataDmp( pMds->TxBuffer[PacketId], 50, 0);
		//The next 802.1x message callback after 2 MIC error occur within 60s
		//TODO: ?? Don't care whether the next 802.1x message is transmitted successfully??
		//if (Adapter->Mds.boCounterMeasureBlock &&
			//8byte USB + 24byte 802.11Hdr + 6 byte EAPOL packet type
		//	(*((USHORT *)(pMds->TxBuffer[PacketId]+38)) == 0x8e88))
		if (pMds->TxInfo[PacketId] == 1)
		{
			//It needs to send disassoc. frame no matter the connection is still
			//alive or not(AP disassoc. us).
			#ifdef _PE_STATE_DUMP_
			WBDEBUG(("!!Countermeasure, disassoc !!\n"));
			#endif
			pMds->TxInfo[PacketId] = 0;
			if (CURRENT_LINK_ON)
			{
				wReasonCode = REASON_MIC_ERROR;
				sSmeMsg.wMsgType = SMEMSG_DISASSOC_REQ;
				sSmeMsg.pMsgPtr = &wReasonCode;
				SME_Entry(Adapter, &sSmeMsg);
			}
			else
			{
				//Maybe AP has disassoc. us firstly, but we still need send it.
				pTxBuffer = pMds->pTxBuffer + (MAX_USB_TX_BUFFER * PacketId); //Get buffer
				wIndex = wBSSfindBssID( Adapter, pTxBuffer+12 );
				SendDisassociation(Adapter, wIndex, REASON_MIC_ERROR);
			}
		}
		// Clear send result buffer
		pMds->TxResult[ PacketId ] = 0;
	}
	else
		pMds->TxResult[ PacketId ] |= ((USHORT)(pT02->value & 0x0ffff));


// 20060928 Remove
//	// Start the next send
//	Mds_Tx( Adapter );
}

VOID
Mds_HeaderCopy( IN PADAPTER Adapter, IN PDESCRIPTOR pDes, IN PUCHAR TargetBuffer )
{
//	phw_data_t pHwData = &Adapter->sHwData;
	PMDS	pMds = &Adapter->Mds;
	PUCHAR	src_buffer = pDes->buffer_address[0];//931130.5.g
	PUCHAR	buffer;
	PT00_DESCRIPTOR	pT00;
	PT01_DESCRIPTOR	pT01;
	USHORT	stmp;
	UCHAR	i, ctmp1, ctmp2, ctmpf;
	USHORT	FragmentThreshold = CURRENT_FRAGMENT_THRESHOLD;


	stmp = pDes->buffer_total_size;
	//
	// Set USB header 8 byte
	//
	pT00 = (PT00_DESCRIPTOR)TargetBuffer;
	TargetBuffer += 4;
	pT01 = (PT01_DESCRIPTOR)TargetBuffer;
	TargetBuffer += 4;

	pT00->value = 0;// Clear
	pT01->value = 0;// Clear

	pT00->T00_tx_packet_id = DESCRIPTOR_GET_ID( pDes );// Set packet ID
	pT00->T00_header_length = 24;// Set header length
	pT01->T01_retry_abort_ebable = 1;//921013 931130.5.h

	// Key ID setup
	pT01->T01_wep_id = CURRENT_WEP_ID;
	if( (CURRENT_BSS_TYPE == ESS_NET) &&
		( (CURRENT_ENCRYPT_STATUS==ENCRYPT_TKIP) || (CURRENT_ENCRYPT_STATUS==ENCRYPT_CCMP) ) )
		pT01->T01_wep_id = 0;

	//
	// Header convert from 802.3 to 802.11
	//
	if( DESCRIPTOR_GET_TYPE( pDes ) == FRAME_TYPE_802_3_DATA )
	{
		// Setting 802.11 Frame control 2 byte
		buffer = TargetBuffer; // Reserved for USB header
		*buffer = 0x08;// Data type
		buffer++;
		*buffer = CURRENT_BSS_TYPE;// BSS type
		// WEP mode
		if( CURRENT_WEP_MODE ) *buffer |= 0x40; // WEP bit setting
		buffer++;
		buffer+=2;// Duration skipping

		if( src_buffer[0] & 0x1 )	// belong to Group address in DA field. Do not fragment.
			FragmentThreshold = DEFAULT_FRAGMENT_THRESHOLD;

		switch( CURRENT_BSS_TYPE )
		{
			case IBSS_NET:
				//Copy DA-SA
				OS_MEMORY_COPY( buffer, src_buffer, DOT_3_TYPE_OFFSET );
				buffer += DOT_3_TYPE_OFFSET;
				//Copy BSSID
				OS_MEMORY_COPY( buffer,	CURRENT_BSSID, ETH_LENGTH_OF_ADDRESS );
				break;

			case ESS_NET:
				//Copy BSSID
				OS_MEMORY_COPY( buffer, CURRENT_BSSID, ETH_LENGTH_OF_ADDRESS );
				buffer += ETH_LENGTH_OF_ADDRESS;
				//Copy SA
				OS_MEMORY_COPY( buffer, (src_buffer+6), ETH_LENGTH_OF_ADDRESS );
				buffer += ETH_LENGTH_OF_ADDRESS;
				//Copy DA
				OS_MEMORY_COPY( buffer, src_buffer, ETH_LENGTH_OF_ADDRESS );
				break;
		}
		buffer += ETH_LENGTH_OF_ADDRESS;

		// Skip Frag number and sequence number, set it to 0
		*(PUSHORT)buffer = 0; // @@ offset 18 from 4n start
		buffer+=2;

		//=====================================================================
		// DA SA process OK, transfer the Type/Length encapsulation
		// The format of first buffer in Descriptor => 14 byte = DA + SA + Type/Length
		//=====================================================================

		//
		// Type or Length encapsulation detect
		//
		src_buffer+=12;
		stmp = src_buffer[0] << 8;
		stmp |= src_buffer[1];
		if( stmp >= 1536 )// Type encapsulated. Else Treated as length encapsulated. Ignore the length field.
		{
			// Fill snap into descriptor 931130.5.i
			pDes->buffer_address[0] = buffer;
			pDes->buffer_size[0] = DOT_11_SNAP_SIZE + 2;

			*(PULONG)buffer = cpu_to_le32(0x0003aaaa);// SNAP have to fill into also // @@ YY's endian
			buffer += 4;
			*(PUSHORT)buffer = 0x0000;// RFC1042 encapsulation format shall be used. //@@

			if( stmp==0x80F3 || stmp==0x8137 )//Because the stmp has been translated to big-endian.
			{
				// Type encapsulated but this protocol type in the table
				// 802.1H bridge tunnel encapsulation format shall be used.
				//
				*(PUSHORT)buffer = cpu_to_le16(0xF800); // YY's endian
			}
			buffer+=2;
			*(PUSHORT)buffer = *(PUSHORT)src_buffer;// Copy Type // @@
			pDes->buffer_total_size -= 6;//( (DOT_3_TYPE_OFFSET + 2) - (DOT_11_SNAP_SIZE + 2) );
		}
		else
		{
			// 1'st buffer process complete. Remove the 1'st buffer of descriptor
			pDes->buffer_start_index++;
			pDes->buffer_number--;
			pDes->buffer_total_size -= (DOT_3_TYPE_OFFSET + 2); // 14 byte for DA + SA + Type/Length
		}

// 20060420 For 802.1x + WEP
		if( stmp == 0x888e )
//		// For WPA modifying
//		if( stmp==0x888e && (CURRENT_DESIRED_WPA_ENABLE		//Note: the byte order of stmp has been changed
//			#ifdef _WPA2_
//			||CURRENT_DESIRED_WPA2_ENABLE
//			#endif //end def _WPA2_ 
//			))
		{
			if( !CURRENT_PAIRWISE_KEY_OK )
				TargetBuffer[1] &= 0xbf; //clear encryption
			//In the WPA countermeasure, it needs to recognize whether the packet is 802.1x
			//after two mic error are found within 2 s.
			//The driver should disassociate after the next 802.1x message is transmitted.
			if ( Adapter->Mds.boCounterMeasureBlock )
			{
				pMds->TxInfo[DESCRIPTOR_GET_ID(pDes)] = 1;
				#ifdef _PE_STATE_DUMP_
				WBDEBUG(("This is the 802.1x message before sending disassociation frame.\n"));
				#endif
			}
		}

		// Test fix pairwise key setting.
		if( (src_buffer[3] == 0x03) && // packet type = EAPOL-Key
			(src_buffer[7] == 0x01) && // 4th message of 4 way handshaking
			(src_buffer[8] == 0x09) )
		{
			ULONG	*pKeyNonce;
			UCHAR	i;

			pKeyNonce = (PULONG)((PUCHAR)src_buffer + 19);
			for( i=0; i<4; i++ )
			{
				if( pKeyNonce[i] != 0 )
				{
					break;
				}
			}

			if( i == 4 )
			{
				#ifdef _PE_STATE_DUMP_
				WBDEBUG(("** The 4th message of PairwiseKey 4 way handshaking!!\n"));
				#endif
				pDes->EapFix = 1;
			}
		}
	}
	else
	{
		FragmentThreshold = DEFAULT_FRAGMENT_THRESHOLD;	//Do not fragment
		// Copy full data, the 1'st buffer contain all the data 931130.5.j
		OS_MEMORY_COPY( TargetBuffer, src_buffer, DOT_11_MAC_HEADER_SIZE );// Copy header
		pDes->buffer_address[0] = src_buffer + DOT_11_MAC_HEADER_SIZE;
		pDes->buffer_total_size -= DOT_11_MAC_HEADER_SIZE;
		pDes->buffer_size[0] = pDes->buffer_total_size;
	}

	// Set fragment threshold
	if( CURRENT_ENCRYPT_STATUS == ENCRYPT_WEP )
		FragmentThreshold -= 8;//IV+ICV
	else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_TKIP )
		FragmentThreshold -= 12;//IV+ICV
	else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_CCMP )
		FragmentThreshold -= 16;//IV+MIC
	FragmentThreshold -= (DOT_11_MAC_HEADER_SIZE + 4);
	DESCRIPTOR_SET_FRAGMENT_THRESHOLD( pDes, FragmentThreshold );

	// Set more frag bit
	TargetBuffer[1] |= 0x04;// Set more frag bit

	//
	// Set tx rate
	//
	stmp = *(PUSHORT)(TargetBuffer+30); // 2n alignment address
	if( ((TargetBuffer[0]&MASK_PROTOCOL_VERSION_TYPE) == MAC_TYPE_MANAGEMENT) || (TargetBuffer[4] & 0x01)
		|| (stmp == cpu_to_le16(0x8e88)) )
	{
		//Use basic rate
		ctmp1 = ctmpf = CURRENT_TX_RATE_FOR_MNG;
	}
	else
	{
		if (psLOCAL->TxRateMode == RATE_AUTO)
		{
			UCHAR		RateTmp;
			USHORT		BssIdx;
			UCHAR	 	BitIndex;
			ULONG		BitMap;

			//ctmp1 = MTO_GetTxRate(Adapter, 1000);
			RateTmp = MTO_GetTxRate(Adapter, 1000);
			if (CURRENT_BSS_TYPE == ESS_NET)
			{
				CURRENT_TX_RATE = RateTmp;
				#ifdef _USE_FALLBACK_RATE_
				CURRENT_FALL_BACK_TX_RATE = MTO_GetTxFallbackRate(Adapter);
				#else
				CURRENT_FALL_BACK_TX_RATE = CURRENT_TX_RATE;
				#endif
			}
			else
			{
				//IBSS mode should check whether peer STA supports this rate.
				BitMap = 1 << bRateToBitmapIndex(Adapter, RateTmp);
				BssIdx = wBSSfindMACaddr(Adapter, TargetBuffer+4);	//search based on addr1
				if (BssIdx != 0)
				{
					if (BitMap&
						(psBSS(BssIdx)->dwBasicRateBitmap|psBSS(BssIdx)->dwOperationalRateBitmap))
					{
						CURRENT_TX_RATE = RateTmp;
					}
					else	//This rate obtained from DTO is not supported
					{
						//select the highest rate
						BitMap = psBSS(BssIdx)->dwBasicRateBitmap | psBSS(BssIdx)->dwOperationalRateBitmap;
						for (BitIndex=31 ; BitIndex>0 ; BitIndex--)
						{
							if( BitMap & (1<<BitIndex) )
								break;
						}
						if ( BitIndex == 0)
						{
							//BitIndex = 0 in Bitmap2RateValue table is meaningless
							CURRENT_TX_RATE = CURRENT_TX_RATE_FOR_MNG;
						}
						else
							CURRENT_TX_RATE = bBitmapToRate(BitIndex);
					}
					CURRENT_FALL_BACK_TX_RATE = CURRENT_TX_RATE;
				}
				else
				{
					CURRENT_TX_RATE = CURRENT_FALL_BACK_TX_RATE = CURRENT_TX_RATE_FOR_MNG;
				}
			}
			//WBDEBUG(("Tx rate =%d\n", CURRENT_TX_RATE));
		}
		ctmp1 = CURRENT_TX_RATE;
		ctmpf = CURRENT_FALL_BACK_TX_RATE;

		// Use the DSSS rate for sending during protect mode 931130.5.k
		if( CURRENT_PROTECT_MECHANISM && (pDes->buffer_total_size > DESCRIPTOR_GET_FRAGMENT_THRESHOLD( pDes )) )
		{
			ctmp1 = ctmpf = RATE_11M;
		}
	}

	DESCRIPTOR_SET_TX_RATE( pDes, ctmp1 );
	#ifdef _PE_TX_DUMP_
	WBDEBUG(("Tx rate =%x\n", ctmp1));
	#endif

	pT01->T01_modulation_type = (ctmp1%3) ? 0 : 1;

	for( i=0; i<2; i++ )
	{
		if( i == 1 )
			ctmp1 = ctmpf;

		pMds->TxRate[DESCRIPTOR_GET_ID(pDes)][i] = ctmp1; // backup the ta rate and fall back rate

		if( ctmp1 == 108) ctmp2 = 7;
		else if( ctmp1 == 96 ) ctmp2 = 6; // Rate convert for USB
		else if( ctmp1 == 72 ) ctmp2 = 5;
		else if( ctmp1 == 48 ) ctmp2 = 4;
		else if( ctmp1 == 36 ) ctmp2 = 3;
		else if( ctmp1 == 24 ) ctmp2 = 2;
		else if( ctmp1 == 18 ) ctmp2 = 1;
		else if( ctmp1 == 12 ) ctmp2 = 0;
		else if( ctmp1 == 22 ) ctmp2 = 3;
		else if( ctmp1 == 11 ) ctmp2 = 2;
		else if( ctmp1 == 4  ) ctmp2 = 1;
		else ctmp2 = 0; // if( ctmp1 == 2  ) or default

		if( i == 0 )
			pT01->T01_transmit_rate = ctmp2;
		else
			pT01->T01_fall_back_rate = ctmp2;
	}

	//
	// Set preamble type
	//
	if ((pT01->T01_modulation_type == 0) && (pT01->T01_transmit_rate == 0))	// RATE_1M
		DESCRIPTOR_SET_PREAMBLE_MODE( pDes, WLAN_PREAMBLE_TYPE_LONG );
	else
		DESCRIPTOR_SET_PREAMBLE_MODE( pDes, CURRENT_PREAMBLE_MODE );
	pT01->T01_plcp_header_length = DESCRIPTOR_GET_PREAMBLE_MODE( pDes );// Set preamble

}

// The function return the 4n size of usb pk
USHORT
Mds_BodyCopy( IN PADAPTER Adapter, IN PDESCRIPTOR pDes, IN PUCHAR TargetBuffer )
{
	PT00_DESCRIPTOR	pT00;
	PMDS	pMds = &Adapter->Mds;
	PUCHAR	buffer, src_buffer, pctmp;
	USHORT	Size = 0;
	USHORT	SizeLeft, CopySize, CopyLeft, stmp;
	UCHAR	buf_index, FragmentCount = 0;


	// Copy fragment body
	buffer = TargetBuffer; // shift 8B usb + 24B 802.11
	SizeLeft = pDes->buffer_total_size;
	buf_index = pDes->buffer_start_index;

	pT00 = (PT00_DESCRIPTOR)buffer;
	while( SizeLeft )
	{
//950301 delete due to HW
//		// 931130.5.l
//		OS_ATOMIC_INC( Adapter, &pMds->TxConcurrentCount );

		pT00 = (PT00_DESCRIPTOR)buffer;
		CopySize = SizeLeft;
		if( SizeLeft > DESCRIPTOR_GET_FRAGMENT_THRESHOLD(pDes) )
		{
			CopySize = DESCRIPTOR_GET_FRAGMENT_THRESHOLD(pDes);
			pT00->T00_frame_length = 24 + CopySize;//Set USB length
		}
		else
			pT00->T00_frame_length = 24 + SizeLeft;//Set USB length

		SizeLeft -= CopySize;

		// 1 Byte operation
		pctmp = (PUCHAR)( buffer + 8 + DOT_11_SEQUENCE_OFFSET );
		*pctmp &= 0xf0;
		*pctmp |= FragmentCount;//931130.5.m
		if( !FragmentCount )
			pT00->T00_first_mpdu = 1;

		buffer += 32; // 8B usb + 24B 802.11 header
		Size += 32;

		// Copy into buffer
		stmp = CopySize + 3;
		stmp &= ~0x03;//4n Alignment
		Size += stmp;// Current 4n offset of mpdu

		while( CopySize )
		{
			// Copy body
			src_buffer = pDes->buffer_address[buf_index];
			CopyLeft = CopySize;
			if( CopySize >= pDes->buffer_size[buf_index] )
			{
				CopyLeft = pDes->buffer_size[buf_index];

				// Get the next buffer of descriptor
				buf_index++;
				buf_index %= MAX_DESCRIPTOR_BUFFER_INDEX;
			}
			else
			{
				PUCHAR	pctmp = pDes->buffer_address[buf_index];
				pctmp += CopySize;
				pDes->buffer_address[buf_index] = pctmp;
				pDes->buffer_size[buf_index] -= CopySize;
			}

			OS_MEMORY_COPY( buffer,	src_buffer, CopyLeft );
			buffer += CopyLeft;
			CopySize -= CopyLeft;
		}

		// 931130.5.n
		if( pMds->MicAdd )
		{
			if( !SizeLeft ) //931130.5.o
			{
				pMds->MicWriteAddress[ pMds->MicWriteIndex ] = buffer - pMds->MicAdd;
				pMds->MicWriteSize[ pMds->MicWriteIndex ] = pMds->MicAdd;
				pMds->MicAdd = 0;
			}
			else if( SizeLeft < 8 ) //931130.5.p
			{
				pMds->MicAdd = SizeLeft;
				pMds->MicWriteAddress[ pMds->MicWriteIndex ] = buffer - ( 8 - SizeLeft );
				pMds->MicWriteSize[ pMds->MicWriteIndex ] = 8 - SizeLeft;
				pMds->MicWriteIndex++;
			}
		}

		// Does it need to generate the new header for next mpdu?
		if( SizeLeft )
		{
			buffer = TargetBuffer + Size; // Get the next 4n start address
			OS_MEMORY_COPY( buffer, TargetBuffer, 32 );//Copy 8B USB +24B 802.11
			pT00 = (PT00_DESCRIPTOR)buffer;
			pT00->T00_first_mpdu = 0;
		}

		FragmentCount++;
	}

	pT00->T00_last_mpdu = 1;
	pT00->T00_IsLastMpdu = 1;
	buffer = (PUCHAR)pT00 + 8; // +8 for USB hdr
	buffer[1] &= ~0x04; // Clear more frag bit of 802.11 frame control
	DESCRIPTOR_SET_FRAGMENT_COUNT( pDes, FragmentCount ); // Update the correct fragment number

	return Size;
}


VOID
Mds_DurationSet( IN PADAPTER Adapter, IN PDESCRIPTOR pDes, IN PUCHAR buffer )
{
	PT00_DESCRIPTOR	pT00;
	PT01_DESCRIPTOR	pT01;
	USHORT	Duration, NextBodyLen, OffsetSize;
	UCHAR	Rate, i;
	BOOLEAN	CTS_on = FALSE, RTS_on = FALSE;
	PT00_DESCRIPTOR pNextT00;
	USHORT BodyLen;
	BOOLEAN boGroupAddr = FALSE;


	OffsetSize = pDes->FragmentThreshold + 32 + 3;
	OffsetSize &= ~0x03;
	Rate = pDes->TxRate >> 1;

	pT00 = (PT00_DESCRIPTOR)buffer;
	pT01 = (PT01_DESCRIPTOR)(buffer+4);
	pNextT00 = (PT00_DESCRIPTOR)(buffer+OffsetSize);

	if( buffer[ DOT_11_DA_OFFSET+8 ] & 0x1 ) // +8 for USB hdr
		boGroupAddr = TRUE;

	//========================================
	// Set RTS/CTS mechanism
	//========================================
	if (!boGroupAddr)
	{
		//NOTE : If the protection mode is enabled and the MSDU will be fragmented,
		//		 the tx rates of MPDUs will all be DSSS rates. So it will not use
		//		 CTS-to-self in this case. CTS-To-self will only be used when without
		//		 fragmentation. -- 20050112
		BodyLen = (USHORT)pT00->T00_frame_length;	//include 802.11 header
		if( CURRENT_ENCRYPT_STATUS == ENCRYPT_WEP )
			BodyLen += 8;//IV+ICV
		else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_TKIP )
			BodyLen += 12;//IV+ICV
		else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_CCMP )
			BodyLen += 16;//IV+MIC
		BodyLen += 4;	//CRC

		if( BodyLen >= CURRENT_RTS_THRESHOLD )
			RTS_on = TRUE; // Using RTS
		else
		{
			if( pT01->T01_modulation_type ) // Is using OFDM
			{
				if( CURRENT_PROTECT_MECHANISM ) // Is using protect
					CTS_on = TRUE; // Using CTS
			}
		}
	}

	if( RTS_on || CTS_on )
	{
		if( pT01->T01_modulation_type) // Is using OFDM
		{
			//CTS duration
			// 2 SIFS + DATA transmit time + 1 ACK
			// ACK Rate : 24 Mega bps
			// ACK frame length = 14 bytes
			Duration = 2*DEFAULT_SIFSTIME +
					   2*PREAMBLE_PLUS_SIGNAL_PLUS_SIGNALEXTENSION +
					   ((BodyLen*8 + 22 + Rate*4 - 1)/(Rate*4))*Tsym +
					   ((112 + 22 + 95)/96)*Tsym;
		}
		else	//DSSS
		{
			//CTS duration
			// 2 SIFS + DATA transmit time + 1 ACK
			// Rate : ?? Mega bps
			// ACK frame length = 14 bytes
			if( pT01->T01_plcp_header_length ) //long preamble
				Duration = LONG_PREAMBLE_PLUS_PLCPHEADER_TIME*2;
			else
				Duration = SHORT_PREAMBLE_PLUS_PLCPHEADER_TIME*2;

			Duration += ( ((BodyLen + 14)*8 + Rate-1) / Rate +
						DEFAULT_SIFSTIME*2 );
		}

		if( RTS_on )
		{
			if( pT01->T01_modulation_type ) // Is using OFDM
			{
				//CTS + 1 SIFS + CTS duration
				//CTS Rate : 24 Mega bps
				//CTS frame length = 14 bytes
				Duration += (DEFAULT_SIFSTIME + 
								PREAMBLE_PLUS_SIGNAL_PLUS_SIGNALEXTENSION +
								((112 + 22 + 95)/96)*Tsym);
			}
			else
			{
				//CTS + 1 SIFS + CTS duration
				//CTS Rate : ?? Mega bps
				//CTS frame length = 14 bytes
				if( pT01->T01_plcp_header_length ) //long preamble
					Duration += LONG_PREAMBLE_PLUS_PLCPHEADER_TIME;
				else
					Duration += SHORT_PREAMBLE_PLUS_PLCPHEADER_TIME;

				Duration += ( ((112 + Rate-1) / Rate) + DEFAULT_SIFSTIME );
			}
		}

		// Set the value into USB descriptor
		pT01->T01_add_rts = RTS_on ? 1 : 0;
		pT01->T01_add_cts = CTS_on ? 1 : 0;
		pT01->T01_rts_cts_duration = Duration;
	}

	//=====================================
	// Fill the more fragment descriptor
	//=====================================
	if( boGroupAddr )
		Duration = 0;
	else
	{
		//for( i=0; i<pDes->FragmentCount-1; i++ )
		for( i=pDes->FragmentCount-1; i>0; i-- )
		{
			NextBodyLen = (USHORT)pNextT00->T00_frame_length;
			if( CURRENT_ENCRYPT_STATUS == ENCRYPT_WEP )
				NextBodyLen += 8;//IV+ICV
			else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_TKIP )
				NextBodyLen += 12;//IV+ICV
			else if( CURRENT_ENCRYPT_STATUS == ENCRYPT_CCMP )
				NextBodyLen += 16;//IV+MIC
			NextBodyLen += 4;	//CRC

			if( pT01->T01_modulation_type )
			{
				//OFDM
				// data transmit time + 3 SIFS + 2 ACK
				// Rate : ??Mega bps
				// ACK frame length = 14 bytes, tx rate = 24M
				Duration = PREAMBLE_PLUS_SIGNAL_PLUS_SIGNALEXTENSION * 3;
				Duration += (((NextBodyLen*8 + 22 + Rate*4 - 1)/(Rate*4)) * Tsym +
							(((2*14)*8 + 22 + 95)/96)*Tsym +
							DEFAULT_SIFSTIME*3);
			}
			else
			{
				//DSSS
				// data transmit time + 2 ACK + 3 SIFS
				// Rate : ??Mega bps
				// ACK frame length = 14 bytes
				//TODO :
				if( pT01->T01_plcp_header_length ) //long preamble
					Duration = LONG_PREAMBLE_PLUS_PLCPHEADER_TIME*3;
				else
					Duration = SHORT_PREAMBLE_PLUS_PLCPHEADER_TIME*3;

				Duration += ( ((NextBodyLen + (2*14))*8 + Rate-1) / Rate +
							DEFAULT_SIFSTIME*3 );
			}

			((PUSHORT)buffer)[5] = cpu_to_le16(Duration);// 4 USHOR for skip 8B USB, 2USHORT=FC + Duration
			#if 0 //20061009 marked by anson's endian
			#ifdef WB_LINUX // Suitable for Big/Little endian
			{
				ULONG	ltmp;
				ltmp = pNextT00->T00_frame_length;
				ltmp |= (pNextT00->T00_header_length<<12);
				ltmp |= (pNextT00->T00_tx_packet_id<<22);
				ltmp |= (pNextT00->T00_IgnoreResult<<28);
				ltmp |= (pNextT00->T00_IsLastMpdu<<29);
				ltmp |= (pNextT00->T00_last_mpdu<<30);
				ltmp |= (pNextT00->T00_first_mpdu<<31);
				pNextT00->value = cpu_to_le32( ltmp );

				ltmp = pT01->T01_retry_abort_ebable;
				ltmp |= (pT01->T01_wep_id<<4);
				ltmp |= (pT01->T01_transmit_rate<<6);
				ltmp |= (pT01->T01_plcp_header_length<<9);
				ltmp |= (pT01->T01_modulation_type<<10);
				ltmp |= (pT01->T01_add_cts<<11);
				ltmp |= (pT01->T01_add_rts<<12);
				ltmp |= (pT01->T01_rts_cts_duration<<16);
				//pT01->value = cpu_to_le16( pT01->value );
				pT01->value = cpu_to_le32( ltmp );  //anson
			}
			#endif
			#endif
			
			//----20061009 add by anson's endian
			pNextT00->value = cpu_to_le32(pNextT00->value);
			pT01->value = cpu_to_le32( pT01->value );
			//----end 20061009 add by anson's endian

			buffer += OffsetSize;
			pT01 = (PT01_DESCRIPTOR)(buffer+4);
			if (i != 1)	//The last fragment will not have the next fragment
				pNextT00 = (PT00_DESCRIPTOR)(buffer+OffsetSize);
		}

		//=====================================
		// Fill the last fragment descriptor
		//=====================================
		if( pT01->T01_modulation_type )
		{
			//OFDM
			// 1 SIFS + 1 ACK
			// Rate : 24 Mega bps
			// ACK frame length = 14 bytes
			Duration = PREAMBLE_PLUS_SIGNAL_PLUS_SIGNALEXTENSION;
			//The Tx rate of ACK use 24M
			Duration += (((112 + 22 + 95)/96)*Tsym + DEFAULT_SIFSTIME );
		}
		else
		{
			// DSSS
			// 1 ACK + 1 SIFS
			// Rate : ?? Mega bps
			// ACK frame length = 14 bytes(112 bits)
			if( pT01->T01_plcp_header_length ) //long preamble
				Duration = LONG_PREAMBLE_PLUS_PLCPHEADER_TIME;
			else
				Duration = SHORT_PREAMBLE_PLUS_PLCPHEADER_TIME;

			Duration += ( (112 + Rate-1)/Rate +	DEFAULT_SIFSTIME );
		}
	}

	((PUSHORT)buffer)[5] = cpu_to_le16(Duration);// 4 USHOR for skip 8B USB, 2USHORT=FC + Duration
	#if 0  //20061009 marked by anson's endian
	#ifdef WB_LINUX // Suitable for Big/Little endian
	{
	
		ULONG	ltmp;
		ltmp = pT00->T00_frame_length;
		ltmp |= (pT00->T00_header_length<<12);
		ltmp |= (pT00->T00_tx_packet_id<<22);
		ltmp |= (pT00->T00_IgnoreResult<<28);
		ltmp |= (pT00->T00_IsLastMpdu<<29);
		ltmp |= (pT00->T00_last_mpdu<<30);
		ltmp |= (pT00->T00_first_mpdu<<31);
		pT00->value = cpu_to_le32( ltmp );

		ltmp = pT01->T01_retry_abort_ebable;
		ltmp |= (pT01->T01_wep_id<<4);
		ltmp |= (pT01->T01_transmit_rate<<6);
		ltmp |= (pT01->T01_plcp_header_length<<9);
		ltmp |= (pT01->T01_modulation_type<<10);
		ltmp |= (pT01->T01_add_cts<<11);
		ltmp |= (pT01->T01_add_rts<<12);
		ltmp |= (pT01->T01_rts_cts_duration<<16);
		//pT01->value = cpu_to_le16( pT01->value );
		pT01->value = cpu_to_le32( ltmp );  //anson
	}
	#endif
	#endif //20061009 ----
	//---20061009 add by anson's endian
	pT00->value = cpu_to_le32(pT00->value);
	pT01->value = cpu_to_le32(pT01->value);
	//--end 20061009 add

}

///////////////////////////////////////////////////////////////////////////////
//Added by WangJS 2006.7.28
///////////////////////////////////////////////////////////////////////////////
USHORT MDS_GetPacketSize( IN PADAPTER Adapter ) // Get packet size
{
	// Case 1 : send TS frame
	if( TS_RUNNING_IN_TESTSTA_MODE )
		return TS_GetPacketSize( Adapter );

#ifdef WB_LINUX_WPA_PSK
	// Case 2 : send WPA data frame which generates in driver
	return WB_WPA_PSK_FRAME_SIZE( Adapter );
#else
	return 0;
#endif
}

VOID MDS_GetNextPacket( IN PADAPTER Adapter, IN PDESCRIPTOR pDes )
{
	// Case 1 :  Get TS frame entity
	if( TS_RUNNING_IN_TESTSTA_MODE )
		TS_GetNextPacket( Adapter, pDes );

#ifdef WB_LINUX_WPA_PSK
	// Case 2 : Get WPA frame entity
	GetEAPoLPacket( Adapter, pDes );
#endif
}

VOID MDS_GetNextPacketComplete( IN PADAPTER Adapter, IN PDESCRIPTOR pDes )
{
	// Case 1 : send TS frame
	if( TS_RUNNING_IN_TESTSTA_MODE )
		TS_GetNextPacketComplete( Adapter, pDes );

#ifdef WB_LINUX_WPA_PSK
	// Case 2 : Get WPA frame complete
	GetEAPoLPacketComplete( Adapter, pDes );
#endif
}

VOID MDS_SendResult( IN PADAPTER Adapter, IN UCHAR PacketId, IN BOOLEAN SendOK )
{
	// Case 1 : send TS frame
	if( TS_RUNNING_IN_TESTSTA_MODE )
		TS_SendResult( Adapter, PacketId, SendOK );

	// Case 2 : Ignore WPA send result
}

VOID MDS_EthernetPacketReceive( IN PADAPTER Adapter, IN PRXLAYER1 pRxLayer1 )
{
#ifdef WB_LINUX_WPA_PSK
//	PUCHAR		BufAddr, pctmp;
//	USHORT		BufSize, stmp;
     PUCHAR pctmp;
     USHORT stmp;
	pctmp = pRxLayer1->BufferQueue[0].pBufferAddress + 12;
	stmp = pctmp[0] << 8;
	stmp |= pctmp[1];

	if( stmp == 0x888e )
		OS_RECEIVE_802_1X_PACKET_INDICATE( Adapter, pRxLayer1 );
	else
#endif
		OS_RECEIVE_PACKET_INDICATE( Adapter, pRxLayer1 );
}


